This talk discloses several design-based vulnerabilities in macOS. Unlike code-level bugs, design flaws are often difficult to fix in one shot, since the same vulnerable logic may exist across multiple Apple platforms, including macOS, iOS, and watchOS. Fully addressing the root cause may require refactoring an entire framework, so vendors may first ship temporary mitigations that block only specific exploit paths.

The talk uses non-atomic operation attack surfaces as an example, introduces Apple’s related protection mechanism, and discloses three vulnerabilities that can achieve local privilege escalation against arbitrary apps, including Apple-signed apps, to obtain target entitlements. It also introduces five additional derived design-based vulnerabilities and practical exploitation techniques for making certain exploits quieter and lower-noise.